<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>User Agent processor | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'user-agent-processor.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/user-agent-processor.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/user-agent-processor.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/user-agent-processor.html" rel="nofollow" target="_blank">../en/user-agent-processor.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="ingest.html">Ingest node</a></span>
»
<span class="breadcrumb-link"><a href="ingest-processors.html">Processors</a></span>
»
<span class="breadcrumb-node">User Agent processor</span>
</div>
<div class="navheader">
<span class="prev">
<a href="urldecode-processor.html">« URL Decode Processor</a>
</span>
<span class="next">
<a href="index-lifecycle-management.html">ILM: Manage the index lifecycle »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="user-agent-processor"></a>User Agent processor<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/user-agent.asciidoc">edit</a>
</h2>
</div></div></div>
<p>The <code class="literal">user_agent</code> processor extracts details from the user agent string a browser sends with its web requests.
This processor adds this information by default under the <code class="literal">user_agent</code> field.</p>
<p>The ingest-user-agent module ships by default with the regexes.yaml made available by uap-java with an Apache 2.0 license. For more details see <a href="https://github.com/ua-parser/uap-core" class="ulink" target="_top">https://github.com/ua-parser/uap-core</a>.</p>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="using-ingest-user-agent"></a>Using the user_agent Processor in a Pipeline<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/user-agent.asciidoc">edit</a>
</h3>
</div></div></div>
<div class="table">
<a id="ingest-user-agent-options"></a>
<p class="title"><strong>Table 68. User-agent options</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="User-agent options">
<colgroup>
<col class="col_1">
<col class="col_2">
<col class="col_3">
<col class="col_4">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Required</th>
<th align="left" valign="top">Default</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">field</code></p></td>
<td align="left" valign="top"><p>yes</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The field containing the user agent string.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">target_field</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>user_agent</p></td>
<td align="left" valign="top"><p>The field that will be filled with the user agent details.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">regex_file</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The name of the file in the <code class="literal">config/ingest-user-agent</code> directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with (see below).</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">properties</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>[<code class="literal">name</code>, <code class="literal">major</code>, <code class="literal">minor</code>, <code class="literal">patch</code>, <code class="literal">build</code>, <code class="literal">os</code>, <code class="literal">os_name</code>, <code class="literal">os_major</code>, <code class="literal">os_minor</code>, <code class="literal">device</code>]</p></td>
<td align="left" valign="top"><p>Controls what properties are added to <code class="literal">target_field</code>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">ignore_missing</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p><code class="literal">false</code></p></td>
<td align="left" valign="top"><p>If <code class="literal">true</code> and <code class="literal">field</code> does not exist, the processor quietly exits without modifying the document</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">ecs</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p><code class="literal">true</code></p></td>
<td align="left" valign="top"><p><span class="Admonishment Admonishment--change">
[<span class="Admonishment-version u-mono u-strikethrough">7.2</span>]
<span class="Admonishment-detail">
Deprecated in 7.2.
</span>
</span> Whether to return the output in Elastic Common Schema format.</p></td>
</tr>
</tbody>
</table>
</div>
</div>
<p>Here is an example that adds the user agent details to the <code class="literal">user_agent</code> field based on the <code class="literal">agent</code> field:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">PUT _ingest/pipeline/user_agent
{
  "description" : "Add user agent information",
  "processors" : [
    {
      "user_agent" : {
        "field" : "agent"
      }
    }
  ]
}
PUT my_index/_doc/my_id?pipeline=user_agent
{
  "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
}
GET my_index/_doc/my_id</pre>
</div>
<div class="console_widget" data-snippet="snippets/1100.console"></div>
<p>Which returns</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
  "found": true,
  "_index": "my_index",
  "_type": "_doc",
  "_id": "my_id",
  "_version": 1,
  "_seq_no": 22,
  "_primary_term": 1,
  "_source": {
    "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36",
    "user_agent": {
      "name": "Chrome",
      "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36",
      "version": "51.0.2704.103",
      "os": {
        "name": "Mac OS X",
        "version": "10.10.5",
        "full": "Mac OS X 10.10.5"
      },
      "device" : {
        "name" : "Other"
      },
    }
  }
}</pre>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="_using_a_custom_regex_file"></a>Using a custom regex file<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/user-agent.asciidoc">edit</a>
</h4>
</div></div></div>
<p>To use a custom regex file for parsing the user agents, that file has to be put into the <code class="literal">config/ingest-user-agent</code> directory and
has to have a <code class="literal">.yml</code> filename extension. The file has to be present at node startup, any changes to it or any new files added
while the node is running will not have any effect.</p>
<p>In practice, it will make most sense for any custom regex file to be a variant of the default file, either a more recent version
or a customised version.</p>
<p>The default file included in <code class="literal">ingest-user-agent</code> is the <code class="literal">regexes.yaml</code> from uap-core: <a href="https://github.com/ua-parser/uap-core/blob/master/regexes.yaml" class="ulink" target="_top">https://github.com/ua-parser/uap-core/blob/master/regexes.yaml</a></p>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="ingest-user-agent-settings"></a>Node Settings<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/user-agent.asciidoc">edit</a>
</h4>
</div></div></div>
<p>The <code class="literal">user_agent</code> processor supports the following setting:</p>
<div class="variablelist">
<dl class="variablelist">
<dt>
<span class="term">
<code class="literal">ingest.user_agent.cache_size</code>
</span>
</dt>
<dd>
The maximum number of results that should be cached. Defaults to <code class="literal">1000</code>.
</dd>
</dl>
</div>
<p>Note that these settings are node settings and apply to all <code class="literal">user_agent</code> processors, i.e. there is one cache for all defined <code class="literal">user_agent</code> processors.</p>
</div>

</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="urldecode-processor.html">« URL Decode Processor</a>
</span>
<span class="next">
<a href="index-lifecycle-management.html">ILM: Manage the index lifecycle »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>